Introduction I created a read-only vCenter custom role for an Aria Operations service account. The role grants the privileges needed for monitoring without adding the permissions required to run remediation actions.

Before You Begin

Prerequisites Before we begin, ensure you have the following:

  • Access to vCenter with administrative privileges.
  • VMware PowerCLI installed on your system.
  • Basic understanding of VMware vSphere and Aria Operations.

Connecting to vCenter with PowerCLI

Step 1: Connect to Your vCenter Server Open VMware PowerCLI and connect to your vCenter server using the following commands. Replace the placeholders with your actual login credentials and vCenter server details.

$vcServer = 'vcenter.yourdomain.com'
$username = 'administrator@yourdomain.com'
$password = 'yourPassword'
Connect-VIServer -Server $vcServer -User $username -Password $password

Defining the Required Permissions

Step 2: Define the Role and Required Permissions Define the role name and the specific permissions needed for Aria Operations to monitor the system. Here, we create a variable for the role and an array containing all necessary permissions IDs.

$permissions = @(
    "System.Anonymous",
    "System.View",
    "System.Read",
    "Global.ManageCustomFields",
    "Global.SetCustomField",
    "Global.Health",
    "Global.SystemTag",
    "Global.GlobalTag",
    "Datastore.Browse",
    "Datastore.AllocateSpace",
    "Host.Inventory.EditCluster",
    "Host.Inventory.ManageClusterLifecyle",
    "VirtualMachine.Inventory.Move",
    "VirtualMachine.GuestOperations.Query",
    "VirtualMachine.GuestOperations.Modify",
    "VirtualMachine.GuestOperations.Execute",
    "VirtualMachine.GuestOperations.QueryAliases",
    "VirtualMachine.GuestOperations.ModifyAliases",
    "VirtualMachine.Namespace.Management",
    "VirtualMachine.Namespace.Query",
    "VirtualMachine.Namespace.ModifyContent",
    "VirtualMachine.Namespace.ReadContent",
    "Resource.AssignVMToPool",
    "Resource.HotMigrate",
    "Resource.ColdMigrate",
    "Resource.QueryVMotion",
    "StorageProfile.Apply",
    "Performance.ModifyIntervals",
    "Extension.Register",
    "Extension.Update",
    "Extension.Unregister",
    "ExternalStatsProvider.Register",
    "ExternalStatsProvider.Update",
    "ExternalStatsProvider.Unregister",
    "vStats.QueryAny",
    "vStats.CollectAny",
    "vStats.Settings",
    "AutoDeploy.Rule.Create",
    "AutoDeploy.RuleSet.Activate",
    "AutoDeploy.Rule.Edit",
    "AutoDeploy.RuleSet.Edit",
    "StorageProfile.Update",
    "StorageProfile.View",
    "StorageViews.ConfigureService",
    "AutoDeploy.Rule.Delete",
    "StorageViews.View"
)

Creating the Custom Role

Step 3: Create the Custom Role Use the New-VIRole cmdlet to create the new role with the defined permissions. This step applies the permissions array to the role.

New-VIRole -Name $roleName -Description $roleDescription -Privilege (Get-VIPrivilege -Id $permissions)
Write-Output "Role '$roleName' created successfully with necessary permissions."

Confirming and Disconnecting

Step 4: Confirm and Disconnect After the role is successfully created, you will receive a confirmation output. Always ensure to disconnect from your vCenter server cleanly to avoid any security issues.

Disconnect-VIServer -Server $vcServer -Confirm:$false

The Complete Script

Step 5: Put it all together

$vcServer = 'vcenter.yourdomain.com'
$username = 'administrator@yourdomain.com'
$password = 'yourPassword'
Connect-VIServer -Server $vcServer -User $username -Password $password
$roleName = "Aria Operations Monitoring Role"
$permissions = @(
    "System.Anonymous",
    "System.View",
    "System.Read",
    "Global.ManageCustomFields",
    "Global.SetCustomField",
    "Global.Health",
    "Global.SystemTag",
    "Global.GlobalTag",
    "Datastore.Browse",
    "Datastore.AllocateSpace",
    "Host.Inventory.EditCluster",
    "Host.Inventory.ManageClusterLifecyle",
    "VirtualMachine.Inventory.Move",
    "VirtualMachine.GuestOperations.Query",
    "VirtualMachine.GuestOperations.Modify",
    "VirtualMachine.GuestOperations.Execute",
    "VirtualMachine.GuestOperations.QueryAliases",
    "VirtualMachine.GuestOperations.ModifyAliases",
    "VirtualMachine.Namespace.Management",
    "VirtualMachine.Namespace.Query",
    "VirtualMachine.Namespace.ModifyContent",
    "VirtualMachine.Namespace.ReadContent",
    "Resource.AssignVMToPool",
    "Resource.HotMigrate",
    "Resource.ColdMigrate",
    "Resource.QueryVMotion",
    "StorageProfile.Apply",
    "Performance.ModifyIntervals",
    "Extension.Register",
    "Extension.Update",
    "Extension.Unregister",
    "ExternalStatsProvider.Register",
    "ExternalStatsProvider.Update",
    "ExternalStatsProvider.Unregister",
    "vStats.QueryAny",
    "vStats.CollectAny",
    "vStats.Settings",
    "AutoDeploy.Rule.Create",
    "AutoDeploy.RuleSet.Activate",
    "AutoDeploy.Rule.Edit",
    "AutoDeploy.RuleSet.Edit",
    "StorageProfile.Update",
    "StorageProfile.View",
    "StorageViews.ConfigureService",
    "AutoDeploy.Rule.Delete",
    "StorageViews.View"
)
New-VIRole -Name $roleName -Privilege (Get-VIPrivilege -Id $permissions)
Write-Output "Role '$roleName' created successfully with necessary permissions."
Disconnect-VIServer -Server $vcServer -Confirm:$false

Result

The resulting role gives the Aria Operations service account the read-only privileges needed for monitoring. If it also needs to run remediation actions, use the separate action-role guide.